Incorrect Condition Check in decodeWellData Function

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-07-basin/blob/7d5aacbb144d0ba0bc358dfde6e0cc913d25310e/src/functions/Stable2.sol#L314-L318

Vulnerability details

The decodeWellData function is supposed to decode the decimals of two tokens from the provided data.

If the decoded values are 0, it should default them to 18.

However, the function mistakenly checks decimal0 twice, potentially leaving decimal1 unchanged if it is 0.

Impact

This logical error can lead to incorrect defaulting of decimal1 if it is 0, causing potential inaccuracies in subsequent calculations that rely on the token decimals.

This might affect the stability and reliability of the contract's functions.

Proof of Concept

The current implementation of the decodeWellData function incorrectly checks decimal0 twice:

        // if well data returns 0, assume 18 decimals.
        if (decimal0 == 0) {
            decimal0 = 18;
        }
        if (decimal0 == 0) {
            decimal1 = 18;

This should be corrected to:

        // if well data returns 0, assume 18 decimals.
        if (decimal0 == 0) {
            decimal0 = 18;
        }
        if (decimal1 == 0) {
            decimal1 = 18;

Tools Used

Manual Review

Recommended Mitigation Steps

Correct the condition in the decodeWellData function to check decimal1 instead of decimal0 in the second condition.

Assessed type

Error

[c4-judge]

alex-ppg changed the severity to 3 (High Risk)

[c4-judge]

alex-ppg marked the issue as satisfactory